fix: prevent admin escalation when AUTH_ENABLED=false

When auth was disabled, the backend middleware attached the first admin
user from the database to every request, and the frontend granted all 12
permissions. This gave every unauthenticated visitor full admin access
to user management, settings, teams, branding, and feature installation.

Now both layers use role "user" with user-level permissions so tools,
files, and pipelines still work without login while admin-only routes
correctly return 403.

Closes #72

apps/web/src/hooks/use-auth.ts

@@ -11,19 +11,12 @@ interface AuthState {
   permissions: string[];
 }
 
-const ALL_PERMISSIONS = [
+const USER_PERMISSIONS = [
   "tools:use",
   "files:own",
-  "files:all",
   "apikeys:own",
-  "apikeys:all",
   "pipelines:own",
-  "pipelines:all",
   "settings:read",
-  "settings:write",
-  "users:manage",
-  "teams:manage",
-  "branding:manage",
 ];
 
 export function useAuth() {
@@ -51,8 +44,8 @@ export function useAuth() {
               authEnabled: false,
               isAuthenticated: true,
               mustChangePassword: false,
-              role: "admin",
-              permissions: ALL_PERMISSIONS,
+              role: "user",
+              permissions: USER_PERMISSIONS,
             });
           return;
         }